The "virus" that jammed thousands of computers in the nation's worst case ever of computer sabotage began in the file of a brilliant first-year Cornell University graduate student, officials said Saturday.
But Cornell investigators were unable to contact the student, Robert Tappan Morris Jr., 23, and had no evidence to identify him positively as the person responsible for jamming a wide government computer network used by top academic and military scientists to trade information."We have no fingerprints. We have no eyewitness, but it was created on his computer account," said Dean Krafft, Cornell's computer facilities manager, among those leading the school's investigation.
The FBI also was investigating the computer crisis to determine if any federal laws were broken, FBI spokesman Mickey Drake said. Under the Computer Fraud and Abuse Act, unauthorized access to federal government computers is a crime.
Krafft, speaking at a news conference on alumni Homecoming Day, said Morris' computer account holds files that appear to have unauthorized passwords for computers at Cornell and Stanford universities. He said it also contains a list of passwords "substantially similiar" to those contained in the virus.
"The fact that these were in the possession of this account - and we can't say for certain that he put them there - but they were in his account and that's unauthorized," said M. Stuart Lynn, vice president for information technologies. However, he said the evidence was not enough to say he is the one who did it.
Lynn, who helped break ground on Cornell's new $30 million supercomputer building Thursday, said the university was preserving all pertinent computer tapes and records to trace the history of the virus.
"If indeed a member of the Cornell community was involved, we will of course take whatever disciplinary action is appropriate," said Lynn.
School officials tried unsuccessfully to contact Morris at both his Ithaca home and his parents' home in the Washington, D.C., area, Lynn said.
In a phone interview Saturday, Robert Morris Sr., the chief scientist at the National Computer Security Center in Bethesda, Md., acknowledged his son may be responsible for the data-devouring virus that has wreaked havoc on computer networks nationwide since Wednesday night.
"I think it's possible," Morris said, but stressed he had "no direct information" on his son's involvement.
The elder Morris, who is widely known for creating a program to decipher passwords that give users access to their computers and their data, said he had not spoken to his son in several days and was unsure of his whereabouts.
The New York Times said Saturday that the younger Morris wrote computer instructions for the virus as an experiment that was intended to live innocently and undetected in ARPAnet, a system on which 300 universities, private research firms and military experts exchange unclassified information.
The paper said the younger Morris flew to Washington Friday, and after hiring a lawyer, planned to meet with officials from the Defense Communications Agency.